marimo Pre-Auth RCE Weaponized in 72 Hours; NKAbuse Botnet Staged on HuggingFace Spaces

CVE-2009-0238: Seventeen-Year-Old Excel Flaw Enters KEV With Active Exploitation

CISA added CVE-2009-0238, an Excel vulnerability first published in February 2009 with CVSS 9.3 and a current EPSS of 0.572, to the KEV catalog with a remediation deadline of 2026-04-28, confirming active attacks against the 17-year-old flaw. The elevated EPSS is algorithmically significant — it reflects recent exploitation telemetry biasing the model, meaning attacker interest is measurably elevated now rather than being a stale residual score. CVE-2026-32201, a SharePoint Server input validation flaw allowing pre-authentication network spoofing, is also confirmed exploited in the wild and carries the same KEV deadline of 2026-04-28. No attribution has been published for either exploitation chain.

The Excel CVE revival is most concerning for environments where Office patch cycles have been deferred due to macro compatibility concerns or legacy line-of-business application dependencies — a pattern disproportionately common in financial services operations. The absence of attribution here is itself notable; a 17-year-old CVE with a 0.572 EPSS and no named actor suggests either a novel exploitation path rediscovery or a deliberate choice to weaponize a bug that many defenders have mentally retired.

EPSS at 0.572 on a 2009 CVE is a telemetry artifact of *current* attacker interest, not a stale residual — the model is telling you someone is actively using this right now. Pairs cleanly with the SharePoint zero-day (CVE-2026-32201) from yesterday's Patch Tuesday; environments where Office patching was deferred for macro or LOB compatibility are the target profile.

Rapid7: Microsoft Self-Flags 19 April CVEs as 'More Likely' To Be Exploited

Rapid7's April 2026 Patch Tuesday analysis confirms 167 Microsoft CVEs — including 80 browser CVEs counted separately — with Microsoft's own exploitation likelihood assessments designating 19 as 'more likely to see future exploitation.' CVE-2026-32201 (SharePoint, KEV 2026-04-28) is the sole confirmed-exploited entry at publication time, with CVE-2026-33824 and CVE-2026-33825 also tracked in Rapid7's coverage. The 19-CVE exploitation-likely list represents Microsoft's internal threat intelligence team's forward-looking assessment, making it a pre-KEV indicator of near-term weaponization candidates.

Microsoft's 'exploitation more likely' designations on 19 CVEs in this batch are an underutilized triage input — they represent the judgment of Microsoft's own detection engineering and threat intel teams, not a CVSS formula. In a 167-CVE cycle, cross-referencing that specific list against your internet-exposed and privileged-access asset inventory is the most efficient path to a second-tier remediation queue beyond the KEV entries.

Microsoft's internal exploitation-likelihood designation is the most underused triage input in the ecosystem — it's the judgment of MSRC's own detection-engineering and threat intel teams, not a CVSS formula. In a 167-CVE cycle, that 19-CVE list is the efficient second-tier queue once the KEV entries are handled.

Malicious LLM Proxy Routers in the Wild; Scattered Spider Among Cited Actors

Risky Biz News reports on malicious LLM proxy router infrastructure deployed in the wild, with activity attributed across APT3 (China), APT37 (North Korea), and Scattered Spider (UNC3944, financially motivated) — actors with entirely different sponsor contexts and operational models, almost certainly representing distinct campaign items within the newsletter's roundup format rather than a coordinated joint operation. Tooling includes Milan and UPPERCUT; UPPERCUT has historical APT10/MenuPass associations rather than APT3, flagging a potential attribution precision issue or evidence of cross-group tool sharing in the source reporting. The malicious proxy technique involves adversary-controlled LLM API infrastructure positioned to intercept, exfiltrate, or manipulate enterprise AI traffic. CVE-2026-5194 (EPSS 0.00035) and CVE-2025-0520 (EPSS 0.020) are also tagged but carry minimal exploitation signal.

The three-actor framing should not be read as a coordinated joint operation — it isn't. What is independently significant is Scattered Spider's apparent pivot toward AI infrastructure targeting: this group's demonstrated track record against financial services firms via social engineering, combined with LLM proxy interception techniques, describes a threat model directly relevant to institutions running internal LLM services or routing to third-party AI APIs through enterprise gateways. Verify that your AI API traffic paths are not traversing adversary-controlled infrastructure, particularly in environments where LLM proxy configuration has been delegated to application teams without central network visibility.

The three-actor framing (APT3, APT37, Scattered Spider) is almost certainly a newsletter-roundup artifact rather than a joint op — and the UPPERCUT/APT3 pairing specifically looks like an attribution slip (UPPERCUT is APT10/MenuPass tooling). What matters for us is Scattered Spider pivoting toward AI infrastructure: a group with a demonstrated financial-services track record via social engineering now moving against LLM traffic paths is a direct threat-model update.

Salt Typhoon Operational Security and Critical Infrastructure Targeting: Deep-Dive

Long-form technical analysis of Salt Typhoon's tradecraft, targeting selection, and OPSEC across critical infrastructure intrusions — strategic context rather than a fresh incident, but substantive enough (2,900+ words) to use as a reference piece for threat modeling telecom and infrastructure dependencies.

Sandworm and NoName057 Combined Attempt Against Swedish Thermal Power Plant

Swedish critical infrastructure targeted in a blended operation combining GRU-linked Sandworm capability with the pro-Russian NoName057 hacktivist front. The state-plus-hacktivist pairing against ICS is a tradecraft pattern worth logging — plausible cover-and-access division of labor rather than noise.

Novel BGP Manipulation Vector in IXP Route Server Architecture

Researcher disclosure of a previously undocumented blind spot in Internet Exchange Point route server configurations enabling BGP manipulation. Relevant to any institution with BGP-adjacent dependencies (transit, anycast DNS, DDoS scrubbing) — worth a conversation with network engineering on upstream IXP exposure.

n8n Workflow Automation Abused for Reconnaissance and Attack Staging

Threat actors operationalizing the legitimate n8n automation platform as recon and credential-harvesting infrastructure. Continues the pattern of living-off-trusted-SaaS (GitHub Actions, HuggingFace, now n8n) — allow-listing by vendor reputation continues to age poorly as an EDR/proxy posture.